The vulnerability arises when a project‑scoped user with the manager role supplies a maliciously constructed configuration for the Ironic‑Python‑Agent. The value given for the ntp_server field is passed directly to the shell without validation, which allows the attacker to execute arbitrary shell commands on the host running the agent. This results in full code execution within the context of the agent process, compromising the integrity and confidentiality of the affected node.

The flaw affects the OpenStack Ironic Python Agent, specifically all releases up to and including version 11.6.0. Deployments using the vulnerable agent without upgrading beyond 11.6.0 are at risk. The vulnerability requires that the attacker holds a project‑scoped manager role, tying exploitation to authenticated users with elevated project permissions.

The CVSS score of 7.2 classifies this as a high‑severity flaw. The EPSS score of less than 1 % indicates a low current exploitation probability, and the vulnerability is not yet listed in CISA's KEV catalog. Based on the description, it is inferred that the likely attack vector involves a project‑scoped manager submitting a malicious configuration that sets the ntp_server field, possibly via the Ironic management API or a local configuration interface. Because the injection occurs at configuration time, exploitation is limited to the window when the configuration is applied, but the impact remains severe once executed.